Impure derivations

[zombiezen]

I'd like to include a feature similar to Nix's impure derivations where any derivation can be marked as impure and will always be run. (And perhaps optionally may be allowed to access the network.) Unlike in Nix, I'm okay with "pure" derivations depending on impure derivations, since if the output has the same content as a previous build, then we can reuse work. (I'm not exactly sure why Nix chose not to permit the same mechanism, but I suspect it's because they don't permit multiple realizations for the same equivalence class.)

The broader reasoning for this is I want to provide users with an "escape hatch" for derivations that they know to be deterministic but can't prove or just want to execute within the build environment. Such derivations can still benefit from all the advantages of the rest of the build system without the user having to boil the ocean to get their build to work.